CVE-2024-22409: Default Privileges allow for high level operations for low privileged users in datahub
DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.12.1Patch PR #9067
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22409?
CVE-2024-22409 is categorized as a low severity vulnerability.
How do I fix CVE-2024-22409?
To mitigate CVE-2024-22409, upgrade DataHub to version 0.12.1 or higher to restrict user permissions.
What are the risks associated with CVE-2024-22409?
The risks associated with CVE-2024-22409 include unauthorized user removals and alterations to group memberships and profile information.
Who is affected by CVE-2024-22409?
Users of DataHub versions below 0.12.1 are affected by CVE-2024-22409.
What changes were made to address CVE-2024-22409?
CVE-2024-22409 addressed the issue of overly broad permissions granted to low privileged users.